continuo-python-runtime 0.3.0__tar.gz → 0.4.0__tar.gz

continuo_python_runtime-0.4.0/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Every change is reviewed by the maintainer.
+*       @carolsimone

continuo_python_runtime-0.4.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,59 @@
+name: Bug report
+description: Something in the Continuo Python runtime behaves incorrectly.
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please do not report security vulnerabilities here — see SECURITY.md.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What did you observe, and what did you expect instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Write a contract with ...
+        2. Run `continuo-runtime validate ...`
+        3. Observe ...
+    validations:
+      required: true
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Which component
+      multiple: true
+      options:
+        - continuo_python_runtime (harness / CLI)
+        - contract (continuo-engine-contract)
+        - adapters/postgres
+        - adapters/trino
+        - template
+        - CI (.github/workflows)
+        - Not sure
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Package version (PyPI) or commit SHA.
+      placeholder: "v0.3.0"
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Please redact any credentials before pasting.
+      render: shell

continuo_python_runtime-0.4.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/carolsimone/continuo-python-runtime/security/advisories/new
+    about: Report privately. Please do not open a public issue for security problems.

continuo_python_runtime-0.4.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Propose a change or addition to the Continuo Python runtime.
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve
+      description: Describe the situation you are in, not the solution you have in mind.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like to happen
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you considered
+
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contribution
+      options:
+        - label: I am willing to open a pull request for this.

continuo_python_runtime-0.4.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## What this changes
+
+<!-- One or two sentences. Link the issue this addresses. -->
+
+Closes #
+
+## Why
+
+<!-- What problem does this solve? -->
+
+## How it was verified
+
+<!-- The commands you ran and what they printed. "Tests pass" on its own is not enough. -->
+
+## Checklist
+
+- [ ] Every commit is signed off (`git commit -s`) — the `dco` check enforces this
+- [ ] Tests added or updated for the behavior changed
+- [ ] `uv run ruff check .` and `uv run mypy` (relevant packages) pass
+- [ ] `scripts/security-scan.sh` passes (dependency or credential-adjacent changes)

continuo_python_runtime-0.4.0/.github/dependabot.yml

@@ -0,0 +1,64 @@
+# Dependabot keeps dependencies current so that known CVEs are fixed by an
+# upgrade before a scanner has to report them.
+#
+# Every ecosystem groups its patch and minor updates into a single pull request
+# per week to keep the noise down. Major updates stay ungrouped because they
+# carry breaking changes and need to be reviewed one at a time.
+version: 2
+
+updates:
+  # The uv workspace: this package (root), contract/, and the two adapters. All
+  # four share one lockfile, but Dependabot still needs one entry per pyproject.toml
+  # directory to see each package's own dependency declarations.
+  - package-ecosystem: uv
+    directories:
+      - /
+      - /contract
+      - /adapters/postgres
+      - /adapters/trino
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      python-minor-patch:
+        applies-to: version-updates
+        update-types: [minor, patch]
+      python-security:
+        applies-to: security-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: chore(deps)
+
+  # Actions are a supply-chain surface in their own right: a compromised or
+  # abandoned action runs with access to the workflow token.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      actions:
+        applies-to: version-updates
+        update-types: [minor, patch]
+      actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: chore(ci)
+
+  # Dockerfile.postgres and Dockerfile.trino, the published engine images. Most
+  # base-image CVEs are fixed by moving to a newer tag.
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      docker:
+        applies-to: version-updates
+        update-types: [minor, patch]
+      docker-security:
+        applies-to: security-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: chore(deps)

{continuo_python_runtime-0.3.0 → continuo_python_runtime-0.4.0}/.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
       - name: Sync
         run: uv sync --all-packages --all-groups
       - name: Lint
@@ -24,9 +24,15 @@ jobs:
         run: uv run --package continuo-python-runtime-trino mypy adapters/trino/continuo_python_runtime_trino
       # `-m "not image"` deselects tests/test_image_smoke_validation.py, which
       # needs a built engine image and the env naming it. Those tests run in
-      # images.yml's smoke jobs, where an image actually exists.
+      # images.yml's smoke jobs, where an image actually exists. `and not
+      # integration` deselects the csv-reader/validation-runner tests that
+      # need a real minio backend (started via `docker run` by the
+      # `minio_container` fixture, not docker-compose) -- those run in the
+      # dedicated step below, on the same runner, where docker is available.
       - name: Tests (runtime)
-        run: uv run pytest --cov=continuo_python_runtime -m "not image" -v
+        run: uv run pytest --cov=continuo_python_runtime -m "not image and not integration" -v
+      - name: Tests (runtime, integration)
+        run: uv run pytest tests/test_csv_readers_integration.py tests/test_validation_runner.py -m integration -v
       - name: Tests (contract)
         run: uv run pytest contract/tests -v
       - name: Tests (adapter units)
@@ -36,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
       - run: uv sync --all-packages --all-groups
       - name: Start postgres stack
         run: docker compose -f tests/smoke/postgres-stack/docker-compose.yml up -d --wait
@@ -50,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
       - run: uv sync --all-packages --all-groups
       - name: Start trino stack
         run: docker compose -f tests/smoke/trino-stack/docker-compose.yml up -d --wait

continuo_python_runtime-0.4.0/.github/workflows/dco.yml

@@ -0,0 +1,49 @@
+name: dco
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  # Job name becomes the check-run name, which is what a branch ruleset requires
+  # by string. Keep it "dco" so the required check is unambiguous.
+  dco:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # The whole PR commit range has to be walkable, not just the merge commit.
+          fetch-depth: 0
+
+      - name: Verify every commit is signed off
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          missing=0
+          while read -r sha; do
+            [ -z "$sha" ] && continue
+            # Merge commits are generated by GitHub and carry no sign-off.
+            if [ "$(git rev-list --no-walk --count --merges "$sha")" -eq 1 ]; then
+              continue
+            fi
+            if ! git show -s --format='%B' "$sha" | grep -qiE '^Signed-off-by: .+ <.+@.+>$'; then
+              echo "::error::Commit $sha ($(git show -s --format='%an' "$sha")) has no Signed-off-by line."
+              missing=1
+            fi
+          done < <(git rev-list "$BASE_SHA".."$HEAD_SHA")
+
+          if [ "$missing" -ne 0 ]; then
+            echo ""
+            echo "Every commit needs a Developer Certificate of Origin sign-off (see DCO)."
+            echo "Fix an existing branch with:"
+            echo "    git rebase --signoff origin/main && git push --force-with-lease"
+            echo "Sign off future commits automatically with 'git commit -s'."
+            exit 1
+          fi
+          echo "All commits signed off."

{continuo_python_runtime-0.3.0 → continuo_python_runtime-0.4.0}/.github/workflows/images.yml

@@ -56,7 +56,7 @@ jobs:
           path: /tmp
       - name: Load image
         run: docker load -i /tmp/cpr-smoke-postgres.tar
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
       - name: Sync
         run: uv sync --all-packages --all-groups
       - name: Image smoke tests (postgres)
@@ -111,7 +111,7 @@ jobs:
           path: /tmp
       - name: Load image
         run: docker load -i /tmp/cpr-smoke-trino.tar
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
       - name: Sync
         run: uv sync --all-packages --all-groups
       - name: Image smoke tests (trino)
@@ -178,15 +178,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
       - name: Log in to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push ${{ matrix.engine }} image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile.${{ matrix.engine }}

{continuo_python_runtime-0.3.0 → continuo_python_runtime-0.4.0}/.github/workflows/publish-pypi.yml

@@ -44,7 +44,7 @@ jobs:
       contents: read # actions/checkout needs read access to the repo
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
       - name: Test before publishing
         # `-m "not image"` deselects the image smoke tests; images.yml runs
         # those against a built engine image.

continuo_python_runtime-0.4.0/.github/workflows/release.yml

@@ -0,0 +1,147 @@
+name: release
+
+# Creates a GitHub Release once BOTH tag-triggered publish workflows
+# (publish-pypi.yml, images.yml) have finished successfully for this exact
+# tag. A Release exists here beyond what PyPI already shows because a tag
+# also ships two ghcr.io images that PyPI knows nothing about — the Release
+# is the one place that says "this tag = these packages + these images."
+#
+# Triggered by the same tag push as its two siblings, rather than by
+# workflow_run watching them complete: `needs:` cannot cross workflow files,
+# and this avoids depending on workflow_run's head_branch semantics for a
+# tag-triggered source run, which nothing else in this repo relies on.
+# Instead the job below polls the Actions API for the sibling runs at this
+# exact commit until both report a conclusion — that only depends on the
+# same push:tags trigger every other release workflow here already uses.
+on:
+  push:
+    tags:
+      # Digit after v: keeps this to release tags, same reasoning continuo's
+      # release.yml uses. publish-pypi.yml and images.yml use the looser `v*`
+      # and instead guard internally with startsWith(..., 'v') checks, so
+      # this is deliberately the stricter of the three triggers.
+      - "v[0-9]*"
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  github-release:
+    # -test tags are a TestPyPI dry run (see publish-pypi.yml) and skip
+    # images.yml's publish job by design (its own if: guards on this same
+    # condition) — no public Release for them.
+    if: "!contains(github.ref_name, '-test')"
+    runs-on: ubuntu-latest
+    # Each wait_for call below can itself run up to 30 minutes (its own
+    # internal timeout), called twice, sequentially — so this job's ceiling
+    # has to clear 60 minutes on its own polling math alone, before even
+    # accounting for how long the siblings actually take to run.
+    timeout-minutes: 70
+    permissions:
+      contents: write # gh release create/edit
+      actions: read # poll sibling workflow runs
+    env:
+      TAG: ${{ github.ref_name }}
+      SHA: ${{ github.sha }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      # Needed for the CHANGELOG.md extraction step below — this job has no
+      # other source of the repo's files. Its absence went unnoticed through
+      # review because this job only triggers on push:tags, never on
+      # pull_request, so no PR's CI ever actually executes it.
+      - uses: actions/checkout@v4
+
+      - name: Wait for publish-pypi.yml and images.yml to finish on this commit
+        run: |
+          set -euo pipefail
+
+          wait_for() {
+            local workflow_file="$1" elapsed=0 interval=20 timeout=1800
+            while :; do
+              # event=push, not just head_sha: images.yml also triggers on
+              # pull_request, and a coincidentally-identical head_sha between
+              # an open PR and this tag would otherwise pick up the wrong run.
+              # Query params go in the URL, not via -f: gh api switches a
+              # request to POST the moment any -f/-F flag is present, and this
+              # listing endpoint only accepts GET — it 404s on POST, which
+              # under `set -e` would abort this script on the very first poll,
+              # every time. Verified against this repo's real API: -f flags
+              # 404 here, the URL query string form returns real run data.
+              conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/workflows/${workflow_file}/runs?head_sha=${SHA}&event=push" \
+                --jq '.workflow_runs[0].conclusion // "pending"')"
+              case "${conclusion}" in
+                success)
+                  echo "${workflow_file}: success"
+                  return 0
+                  ;;
+                pending)
+                  # Covers both "no matching run yet" (API eventual
+                  # consistency right after the push) and "run exists but
+                  # still queued/in_progress" — conclusion is JSON null in
+                  # both cases until the run completes.
+                  ;;
+                *)
+                  echo "::error::${workflow_file} concluded '${conclusion}' for ${SHA}; not creating a Release."
+                  exit 1
+                  ;;
+              esac
+              elapsed=$((elapsed + interval))
+              if [ "${elapsed}" -ge "${timeout}" ]; then
+                echo "::error::timed out after ${timeout}s waiting for ${workflow_file} to finish on ${SHA}."
+                exit 1
+              fi
+              sleep "${interval}"
+            done
+          }
+
+          wait_for "publish-pypi.yml"
+          wait_for "images.yml"
+
+      - name: Extract this version's CHANGELOG section
+        id: notes
+        run: |
+          set -euo pipefail
+          VERSION="${TAG#v}"
+          # Print the body between "## [X.Y.Z]" and the next "## [" heading.
+          if grep -qE "^## \[${VERSION}\]" CHANGELOG.md; then
+            awk -v ver="## [${VERSION}]" '
+              index($0, ver) == 1 { found = 1; next }
+              found && /^## \[/    { exit }
+              found                { print }
+            ' CHANGELOG.md > /tmp/release-body.md
+          fi
+
+          if [ -s /tmp/release-body.md ]; then
+            echo "generate=false" >> "$GITHUB_OUTPUT"
+          else
+            # A tag with no matching CHANGELOG.md section (e.g. someone
+            # forgot to add one before tagging) still gets a Release — just
+            # with GitHub's generated notes instead of failing the job over
+            # a missing doc update.
+            echo "::warning::no '## [${VERSION}]' section in CHANGELOG.md; falling back to generated notes."
+            echo "generate=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create the Release
+        run: |
+          set -euo pipefail
+          # Idempotent: re-running this workflow for an existing tag updates
+          # the Release rather than failing.
+          if gh release view "${TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
+            if [ "${{ steps.notes.outputs.generate }}" = "true" ]; then
+              gh release edit "${TAG}" --repo "${GITHUB_REPOSITORY}" --latest
+            else
+              gh release edit "${TAG}" --repo "${GITHUB_REPOSITORY}" \
+                --notes-file /tmp/release-body.md --latest
+            fi
+          elif [ "${{ steps.notes.outputs.generate }}" = "true" ]; then
+            gh release create "${TAG}" --repo "${GITHUB_REPOSITORY}" \
+              --title "${TAG}" --generate-notes --latest
+          else
+            gh release create "${TAG}" --repo "${GITHUB_REPOSITORY}" \
+              --title "${TAG}" --notes-file /tmp/release-body.md --latest
+          fi

continuo_python_runtime-0.4.0/.github/workflows/security.yml

@@ -0,0 +1,130 @@
+name: security
+
+# Deliberately separate from ci.yml so a scanner failure or the weekly schedule
+# never blocks or piggybacks on the test/lint pipeline.
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  schedule:
+    # Weekly, Monday 04:00 UTC. The scheduled run is the point of this workflow:
+    # most vulnerabilities are disclosed after the code that depends on them was
+    # last touched, so a pull-request-only trigger never sees them.
+    - cron: "0 4 * * 1"
+
+concurrency:
+  # Keyed by event as well as ref. A schedule event and a push to main both carry
+  # github.ref == refs/heads/main, so keying on ref alone would put them in one
+  # group and let a routine merge, via cancel-in-progress, abort the weekly
+  # full-history secret scan — the run this workflow exists for. Including
+  # github.event_name isolates the scheduled run while still superseding stale
+  # per-PR runs (each PR has a distinct ref).
+  group: security-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+# Each job uploads its findings as SARIF, so they land in Security > Code scanning
+# instead of scrolling away in a job log. security-events: write is what permits
+# that upload; contents: read has to be restated because a permissions block
+# replaces the default set rather than adding to it.
+#
+# Note the Security tab will show findings the blocking gate deliberately
+# ignores: the Trivy dependency scan is advisory by design. A green pipeline
+# with open alerts is the intended state, not a contradiction.
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  secrets:
+    name: Secret scan (blocking)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      # Always full history: pull_request and push both need to walk a commit
+      # range (below), and this repository is small enough (a few hundred KB,
+      # well under a second to scan) that fetch-depth: 0 costs nothing on every
+      # trigger rather than only on the schedule.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # pull_request scans exactly the commits the PR introduces (base..head).
+      # A `dir` scan of the final working tree would miss a secret added in one
+      # commit and removed in a later one within the same PR — the working tree
+      # never carries it, but a history-preserving merge still makes that commit
+      # reachable from main. push scans the commits a direct push to main added
+      # (before..after), for the same reason. The weekly schedule walks every
+      # commit reachable from HEAD, catching anything that entered the
+      # repository before this gate existed.
+      - name: Run gitleaks
+        env:
+          SARIF_DIR: sarif
+        run: |
+          case "${{ github.event_name }}" in
+            schedule)
+              bash scripts/security-scan.sh secrets --history
+              ;;
+            pull_request)
+              bash scripts/security-scan.sh secrets --range \
+                "${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
+              ;;
+            push)
+              before="${{ github.event.before }}"
+              # A zero SHA means there is no prior commit to diff from — a new
+              # branch's first push, or history rewritten out from under this
+              # ref. Neither has a meaningful range, so fall back to scanning
+              # just the commit that was pushed.
+              if [ "${before}" = "0000000000000000000000000000000000000000" ]; then
+                before="${{ github.event.after }}^"
+              fi
+              bash scripts/security-scan.sh secrets --range "${before}..${{ github.event.after }}"
+              ;;
+          esac
+      # if: always() — a blocking scan that fails must still publish what it
+      # found, otherwise the findings that justify the failure never appear.
+      #
+      # continue-on-error: true — code scanning needs GitHub Advanced Security,
+      # free on a public repo but not on a private one. This repo is private
+      # until the open-sourcing work lands, so the upload 403s
+      # ("Resource not accessible by integration") on every run until then.
+      # The upload is reporting, not the gate; gitleaks failing the step above
+      # is what actually blocks a merge, and must keep doing so independent of
+      # whether the upload succeeds.
+      - name: Upload SARIF to code scanning
+        if: always()
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: sarif/
+          category: gitleaks
+
+  dependencies:
+    name: Dependency CVEs (advisory)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      # Advisory: reports HIGH/CRITICAL and always exits 0. Base-image and
+      # transitive CVEs are often unfixable upstream, so gating on them would
+      # block every merge behind an ignore-list edit. Dependabot is what actually
+      # resolves these; this job exists to make them visible.
+      - name: Run Trivy dependency scan
+        env:
+          SARIF_DIR: sarif
+        run: bash scripts/security-scan.sh deps
+      # if: always() — a blocking scan that fails must still publish what it
+      # found, otherwise the findings that justify the failure never appear.
+      #
+      # continue-on-error: true — see the identical note on the secrets job;
+      # same GHAS-requires-public-repo cause, same fix.
+      - name: Upload SARIF to code scanning
+        if: always()
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: sarif/
+          category: trivy-fs

continuo_python_runtime-0.4.0/.gitleaks.toml

@@ -0,0 +1,36 @@
+# gitleaks configuration.
+#
+# Extends the upstream default ruleset rather than replacing it, so rules added
+# upstream apply automatically. Only repository-specific exemptions live here.
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Paths that contain no live credentials"
+
+paths = [
+  # Unanchored throughout: the working-tree scan (scripts/security-scan.sh)
+  # mounts the repo at /repo and passes that as the scan target, so gitleaks
+  # matches these patterns against absolute paths like
+  # /repo/.worktrees/stale/file — a leading `^` would never match the actual
+  # prefix and silently disable the exclusion. Verified against v8.24.3 by
+  # planting a fake AWS key under .worktrees/ and confirming a start-anchored
+  # pattern let it through while an unanchored one catches it.
+  #
+  # Local agent worktrees hold full stale copies of every tracked file, so a
+  # finding in the real tree would otherwise be reported once per worktree.
+  '''(^|/)\.worktrees/''',
+  '''(^|/)\.claude/''',
+  # Build/tooling caches, never committed.
+  '''(^|/)\.venv/''',
+  '''(^|/)\.mypy_cache/''',
+  '''(^|/)\.ruff_cache/''',
+  '''(^|/)\.pytest_cache/''',
+  '''(^|/)dist/''',
+  # The tier-2 smoke stacks under tests/smoke/ use documented, throwaway
+  # default credentials for local-only containers (e.g. MinIO's published
+  # "minioadmin"/"minioadmin", Postgres's "continuo"/"continuo") — not
+  # secrets, and never reachable outside the compose network they define.
+  '''(^|/)tests/smoke/[^/]+/docker-compose\.yml$''',
+]